Skip to content

[v20.x] deps: cherry-pick V8 fixes for CVE-2023-3420 and others #50077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
targos wants to merge 5 commits into from
Closed

[v20.x] deps: cherry-pick V8 fixes for CVE-2023-3420 and others #50077

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f2d320b
deps: V8: cherry-pick a1efa5343880
targos Oct 7, 2023
827dd00
deps: V8: cherry-pick 840650f2ff4e
targos Oct 7, 2023
03d1cb7
deps: V8: cherry-pick 9721082687c9
Oct 17, 2023
29146d0
deps: V8: cherry-pick f7d000a7ae7b
lukealbao Oct 23, 2023
ac65ccc
deps: V8: cherry-pick d90d4533b053
targos Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
deps: V8: cherry-pick a1efa5343880 
Original commit message:

    Merged: [runtime] Set instance prototypes directly on maps

    Bug: chromium:1452137
    (cherry picked from commit c7c447735f762f6d6d0878e229371797845ef4ab)

    Change-Id: I611c41f942e2e51f3c4b4f1d119c18410617188e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637888
    Commit-Queue: Igor Sheludko <[email protected]>
    Auto-Submit: Igor Sheludko <[email protected]>
    Commit-Queue: Toon Verwaest <[email protected]>
    Reviewed-by: Toon Verwaest <[email protected]>
    Cr-Commit-Position: refs/branch-heads/11.4@{#47}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@a1efa53
  • Loading branch information
@targos
targos committed Nov 12, 2023
commit f2d320b891fb557588f8dd573f72ecd75a29ff27
2 changes: 1 addition & 1 deletion common.gypi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@

# Reset this number to 0 on major V8 upgrades.
# Increment by one for each non-official patch applied to deps/v8.
'v8_embedder_string': '-node.20',
'v8_embedder_string': '-node.21',

##### V8 defaults for Node.js #####

Expand Down
6 changes: 6 additions & 0 deletions deps/v8/src/objects/js-function.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -676,6 +676,10 @@ void SetInstancePrototype(Isolate* isolate, Handle<JSFunction> function,
// At that point, a new initial map is created and the prototype is put
// into the initial map where it belongs.
function->set_prototype_or_initial_map(*value, kReleaseStore);
if (value->IsJSObjectThatCanBeTrackedAsPrototype()) {
// Optimize as prototype to detach it from its transition tree.
JSObject::OptimizeAsPrototype(Handle<JSObject>::cast(value));
}
} else {
Handle<Map> new_map =
Map::Copy(isolate, initial_map, "SetInstancePrototype");
Expand Down Expand Up @@ -801,8 +805,10 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
Handle<HeapObject> prototype;
if (function->has_instance_prototype()) {
prototype = handle(function->instance_prototype(), isolate);
map->set_prototype(*prototype);
} else {
prototype = isolate->factory()->NewFunctionPrototype(function);
Map::SetPrototype(isolate, map, prototype);
}
DCHECK(map->has_fast_object_elements());

Expand Down